Family
shem
An IoT bot that turns other people's routers and cameras into proxies for rent, spreads from its own victims and changes its hash on every download.
shem is the name its author gave it, and he leaves it written everywhere: in the paths on his disk, in how it introduces itself to the world and in the first bytes of every message to its command centre. I had christened it “zbot” after its cron files; XLab called it Shemzbot in a tweet, putting the two together.
It came in over telnet with the same old factory password, but it hasn’t come to take servers down: what it wants is your connection. It turns the device into an internet exit for rent, spreads from its own victims and changes its fingerprint on every download so it can’t be catalogued. Its command centre lived on bulletproof hosting that changes its name to stay out of reach.
- 29
It told me its name three times
Another IoT ELF with the look of a run-of-the-mill Mirai landed in the decoy. I christened it “zbot” after its cron files, and it turned out that wasn’t even its name: by three separate routes (the paths it left on disk, the banners it speaks SSH and HTTP with, and the first bytes of every message to its C2) the thing kept telling me its real name. Behind it was something more interesting than a server-flooding bot: a machine for renting out its victim’s home line as a proxy. And an operator who, with the whole thing built, kept breaking his own download URLs. XLab had already named it “Shemzbot” in a tweet; this is the teardown that tweet didn’t carry.
shem
2026-10 - 30
The C2's Landlord
Last chapter I opened shem up from the inside, but one thing nagged at me: its command centre is a bare IP, no domain, so I couldn't follow the operator. I pulled on that IP anyway. And what turns up at the other end isn't the operator - it's his landlord: a bulletproof hosting block that swaps its name and its plates to stay out of reach, rents to half a dozen botnets at once, and throws the server away after ten days.
shem
2026-10